Solidity

Mapping

A mapping is a Solidity key-value storage structure that returns a default value for keys that have never been written.

A mapping is a lookup table, but missing keys look like zero values instead of nonexistent values.

Mapping Explained in Detail

A mapping stores values by key, such as balances by address or roles by account. Mappings do not store a list of keys, and every missing key returns the default value for the value type.

That default behavior is useful, but it can hide whether something was never set or was intentionally set to zero.

Smart contract example

mapping(address => uint256) public balances;
mapping(address => bool) public isAdmin;

For both mappings, a missing key returns 0 or false.

Mapping in Auditing

Mappings often guard balances, allowances, nonces, roles, and claimed airdrops. If mapping updates are wrong, users may gain funds, lose funds, replay signatures, or bypass access control.

Auditors pay special attention to default values and deletion behavior.

Red flags in code

  • Zero means both unset and valid.

  • A mapping is expected to be iterable.

  • Parent structs with nested mappings are deleted with unsafe assumptions.

  • Role mappings are updated without events or admin checks.

  • Nonce or claimed mappings are written after external calls.

How to test or review it

  • Test unset key behavior explicitly.

  • Check every write path for balances, roles, approvals, and nonces.

  • Verify deletion behavior for structs that contain mappings.

  • Use invariants for balance and allowance mappings.

  • Confirm claimed or used mappings are updated before risky external interactions.

Sources